Skip to content

Commit bc7a033

Browse files
richlamdevrichlamdev
authored
Merge pull request #7 from richlamdev/unbound-role
inital commit of unbound role
2 parents 88c2fb0 + 394df29 commit bc7a033

File tree

6 files changed

+214
-0
lines changed

6 files changed

+214
-0
lines changed

‎roles/unbound/handlers/main.yml

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
---
2+
- name: reload unbound
3+
service:
4+
name: unbound
5+
state: restarted

‎roles/unbound/tasks/dynamic.yml

+19
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
---
2+
# - name: Set _unbound user as owner for /var/unbound/etc folder
3+
# file:
4+
# path: /var/unbound/etc
5+
# owner: _unbound
6+
# group: "wheel"
7+
# mode: "0755"
8+
9+
- name: deploy unbound.conf template configuration file
10+
template:
11+
src: unbound.conf.j2
12+
dest: "/etc/unbound/"
13+
mode: "0644"
14+
owner: "root"
15+
group: "root"
16+
notify: reload unbound
17+
18+
- name: restart unbound service unconditionally
19+
meta: flush_handlers

‎roles/unbound/tasks/main.yml

+6
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,6 @@
1+
---
2+
- name: static file configuration
3+
import_tasks: static.yml
4+
5+
- name: dynamic file configuration
6+
import_tasks: dynamic.yml

‎roles/unbound/tasks/static.yml

+45
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,45 @@
1+
---
2+
- name: Update APT package cache
3+
apt:
4+
update_cache: yes
5+
cache_valid_time: 3600 # Cache is valid for 1 hour
6+
7+
- name: Install Unbound and ca-certificates
8+
apt:
9+
name: "{{ item }}"
10+
state: present
11+
loop:
12+
- unbound
13+
- unbound-anchor
14+
- ca-certificates
15+
loop_control:
16+
label: "{{ item }}"
17+
18+
- name: Ensure /var/lib/unbound directory exists
19+
file:
20+
path: /var/lib/unbound
21+
state: directory
22+
owner: unbound
23+
group: unbound
24+
mode: '0755'
25+
26+
- name: Download the latest root.hints file
27+
get_url:
28+
url: https://www.internic.net/domain/named.root
29+
dest: /var/lib/unbound/root.hints
30+
owner: unbound
31+
group: unbound
32+
mode: '0644'
33+
force: yes
34+
35+
- name: Install root.key from IANA using unbound-anchor
36+
shell: '/usr/sbin/unbound-anchor -a /var/lib/unbound/root.key'
37+
register: rootkey
38+
failed_when: rootkey.rc not in [0, 1]
39+
changed_when: "'success' in rootkey.stdout or rootkey.rc == 0"
40+
41+
- name: Ensure Unbound service is enabled and running
42+
systemd:
43+
name: unbound
44+
enabled: yes
45+
state: started

‎roles/unbound/templates/unbound.conf.j2

+134
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,134 @@
1+
# /etc/unbound/unbound.conf
2+
#
3+
# Unbound configuration file for Debian.
4+
#
5+
# See the unbound.conf(5) man page.
6+
#
7+
# See /usr/share/doc/unbound/examples/unbound.conf for a commented
8+
# reference config file.
9+
#
10+
# The following line includes additional configuration files from the
11+
# /etc/unbound/unbound.conf.d directory.
12+
include-toplevel: "/etc/unbound/unbound.conf.d/*.conf"
13+
14+
15+
16+
server:
17+
verbosity: 1
18+
#logfile: "/var/unbound/etc/unbound.log"
19+
#logfile: "/var/log/unbound.log"
20+
use-syslog: yes #overrides logfile setting above
21+
log-queries: yes
22+
log-replies: yes
23+
log-tag-queryreply: yes
24+
port: 53
25+
do-ip4: yes
26+
do-ip6: no
27+
do-udp: yes
28+
do-tcp: yes
29+
directory: "/etc/unbound"
30+
#chroot: "/var/unbound"
31+
interface: {{ host_ip }}
32+
interface: 127.0.0.1
33+
34+
access-control: 0.0.0.0/0 refuse
35+
access-control: ::0/0 refuse
36+
access-control: {{ network_addr }}/24 allow
37+
access-control: 127.0.0.0/8 allow_snoop
38+
hide-identity: yes
39+
hide-version: yes
40+
harden-glue: yes
41+
root-hints: "/var/lib/unbound/root.hints"
42+
auto-trust-anchor-file: "/var/lib/unbound/root.key"
43+
val-clean-additional: yes
44+
45+
tls-cert-bundle: "/etc/ssl/certs/ca-certificates.crt"
46+
47+
prefetch: yes
48+
49+
minimal-responses: yes
50+
qname-minimisation: yes
51+
rrset-roundrobin: yes
52+
ssl-upstream: yes
53+
use-caps-for-id: yes
54+
harden-dnssec-stripped: yes
55+
cache-min-ttl: 3600
56+
cache-max-ttl: 86400
57+
58+
private-address: 192.168.0.0/16
59+
private-address: 172.16.0.0/12
60+
private-address: 10.0.0.0/8
61+
62+
private-address: 0.0.0.0/8
63+
private-address: 100.64.0.0/10
64+
private-address: 127.0.0.0/8
65+
private-address: 169.254.0.0/16
66+
private-address: 172.16.0.0/12
67+
private-address: 192.0.0.0/24
68+
private-address: 192.0.2.0/24
69+
private-address: 192.88.99.0/24
70+
private-address: 198.18.0.0/15
71+
private-address: 198.51.100.0/24
72+
private-address: 203.0.113.0/24
73+
private-address: 224.0.0.0/4
74+
private-address: 240.0.0.0/4
75+
private-address: 255.255.255.255/32
76+
77+
78+
# number of threads to create. 1 disables threading. This should equal the number
79+
# of CPU cores in the machine. Our example machine has 4 CPU cores.
80+
num-threads: 4
81+
82+
## Unbound Optimization and Speed Tweaks ###
83+
84+
# the number of slabs to use for cache and must be a power of 2 times the
85+
# number of num-threads set above. more slabs reduce lock contention, but
86+
# fragment memory usage.
87+
msg-cache-slabs: 8
88+
rrset-cache-slabs: 8
89+
infra-cache-slabs: 8
90+
key-cache-size: 32m
91+
key-cache-slabs: 8
92+
93+
# Increase the memory size of the cache. Use roughly twice as much rrset cache
94+
# memory as you use msg cache memory. Due to malloc overhead, the total memory
95+
# usage is likely to rise to double (or 2.5x) the total cache memory. The test
96+
# box has 4gig of ram so 256meg for rrset allows a lot of room for cacheed objects.
97+
rrset-cache-size: 512m
98+
msg-cache-size: 256m
99+
100+
# buffer size for UDP port 53 incoming (SO_RCVBUF socket option). This sets
101+
# the kernel buffer larger so that no messages are lost in spikes in the traffic.
102+
#so-rcvbuf: 1m
103+
#so-rcvbuf: 32m
104+
105+
outgoing-range: 32768
106+
num-queries-per-thread: 4096
107+
infra-cache-numhosts: 100000
108+
109+
110+
## Unbound Optimization and Speed Tweaks ###
111+
112+
113+
# Use an upstream forwarder (recursive resolver) for specific zones.
114+
# Example addresses given below are public resolvers valid as of 2014/03.
115+
#
116+
forward-zone:
117+
name: "." # use for ALL queries
118+
forward-tls-upstream: yes
119+
forward-addr: 9.9.9.9@853#dns.quad9.net
120+
forward-addr: 149.112.112.112@853#dns.quad9.net
121+
forward-addr: 1.1.1.2@853#cloudflare-dns.com
122+
forward-addr: 1.0.0.2@853#cloudflare-dns.com
123+
forward-addr: 185.228.168.9@853#security-filter-dns.cleanbrowsing.org
124+
forward-addr: 185.228.169.9@853#security-filter-dns.cleanbrowsing.org
125+
forward-addr: 176.103.130.130@853#dns.adguard.com
126+
forward-addr: 176.103.130.131@853#dns.adguard.com
127+
#forward-addr: 45.90.28.0#b978e6.dns1.nextdns.io
128+
#forward-addr: 45.90.30.0#b978e6.dns2.nextdns.io
129+
130+
131+
#forward-addr: 185.222.222.222@853 # dns.sb primary
132+
#forward-addr: 185.184.222.222@853 # dns.sb secondary
133+
#forward-addr: 8.8.8.8@853 # google primary
134+
#forward-addr: 8.8.4.4@853 # google secondary

‎roles/unbound/vars/main.yml

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
# replace network interface as required.
2+
# within vim - :3,5s/re0/em0/g OR :3,5s/em0/re0/g
3+
host_ip: "{{ ansible_em0['ipv4'][0].address }}"
4+
network_addr: "{{ ansible_em0['ipv4'][0].network }}"
5+
subnet_mask: "{{ ansible_em0['ipv4'][0].netmask }}"

0 commit comments

Comments
 (0)